CVE-2017-3125

An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker...

CVE-2017-3125

CVE-2017-3125 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail. Affected versions: FortiMail 5.0.0–5.2.9 and 5.3.0–5.3.8. An attacker can trick a logged-in user into clicking a crafted URL, enabling execution of arbitrary scripts in the user’s browser in...

Fortinet FortiMail Cross-Site Scripting Vulnerability (CNVD-2017-04565)

Fortinet FortiMail is a mail information security appliance from the U.S. company Fita Fortinet, which provides a message filtering engine, anti-spam and threat defense. A cross-site scripting vulnerability exists in Fortinet FortiMail that stems from a failure to properly filter user-supplied...

Unauthenticated XSS (Cross Site Scripting) in FortiMail

An unauthenticated XSS vulnerability could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker...

FortiManager (Series) - Multiple Web Vulnerabilities

Document Title: =============== FortiManager Series - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1684 Fortinet PSIRT ID: 1624459 Bulletin:...

Fortinet FortiMail < 4.3.7 / 5.0.x < 5.0.2 Fragmented IPv6 Packet Handling DoS

The version of Fortinet FortiMail installed on the remote host is prior to 4.3.7 / 5.0.2. It is, therefore, affected by a denial of service vulnerability due to improper handling of fragmented IPv6 packets. A remote attacker can exploit this to crash the kernel, resulting in rebooting the device...

Fortinet FortiMail Stored XSS Vulnerability (FG-IR-15-005)

Fortinet FortiMail is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fortinet FortiMail Server Detection via IMAP

Binary data 8732.prm...

Fortinet FortiMail Server Detection via SSL/TLS

Binary data 8736.prm...

Fortinet FortiMail Server Detection via SMTPS

Binary data 8734.prm...

Fortinet FortiMail Server Detection via HTTP

Binary data 8737.prm...

Fortinet FortiMail Server Detection via POP3

Binary data 8730.prm...

Fortinet FortiMail Server Detection via IMAPS

Binary data 8735.prm...

Fortinet FortiMail Server Detection via POP3S

Binary data 8733.prm...

Fortinet FortiMail Server Detection via SMTP

Binary data 8731.prm...

Fortinet FortiMail < 5.0.9 / 5.1.6 / 5.2.4 HTTP Debug Information Disclosure

The remote host is running a version of FortiMail that is prior to 5.0.9 / 5.1.6 / 5.2.4. It is, therefore, affected by an information disclosure vulnerability due to HTTP debug commands improperly dumping user credentials in the debug logs. This allows a remote, authenticated attacker to disclos...

Fortinet FortiMail Information Disclosure Vulnerability

Fortinet FortiMail is a mail information security appliance from the U.S. company Fita Fortinet, which provides a message filtering engine, anti-spam and threat defense. An information disclosure vulnerability exists in Fortinet FortiMail. An attacker is allowed to exploit this vulnerability to...

CVE-2015-3293

FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command...

Command injection

FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command...

CVE-2015-3293

Summary: CVE-2015-3293 affects Fortinet FortiMail 5.0.3–5.2.3, where the HTTP debug command diagonally dump credentials, enabling a remote administrator to obtain user credentials via the diag debug application httpd interface. The vulnerability stems from information disclosure through HTTP debu...